Bug 998935
| Summary: | Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | fedorauser | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 19 | CC: | dominick.grift, dwalsh, fedorauser, mgrepl | ||||
| Target Milestone: | --- | Keywords: | Reopened | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2013-08-22 17:27:32 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Any avc messages or user_avc messages? Can you yum -y update And see if a policy update fixes your problem? *** Bug 998939 has been marked as a duplicate of this bug. *** Hi Dan,
thanks for your fast reaction.
According to yum I'm running latest version (no updates available).
Here is the user_avc I see when doing a tail -f audit.log while logging in:
type=USER_AVC msg=audit(1377005973.010:706): pid=773 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.ConsoleKit.Manager member=OpenSessionWithParameters dest=org.freedesktop.ConsoleKit spid=12681 tpid=1942 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
Please execute # restorecon -R -v /usr/sbin the problem is with Consolekit running as initrc_t. restorecon didn't fix the problem: restorecon -R -v /usr/sbin/ restorecon reset /usr/sbin/rngd context system_u:object_r:bin_t:s0->system_u:object_r:rngd_exec_t:s0 restorecon reset /usr/sbin/iscsiadm context system_u:object_r:bin_t:s0->system_u:object_r:iscsid_exec_t:s0 Is '/usr/sbin/console-kit-daemon' labeled correctly? (I assume this is the relevant file here.) ls -lZ /usr/sbin/console-kit-daemon -rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/sbin/console-kit-daemon After updating to: selinux-policy-3.12.1-71.fc19.noarch selinux-policy-targeted-3.12.1-71.fc19.noarch I run restorecon again: restorecon -R -v /usr/sbin/ restorecon reset /usr/sbin/console-kit-daemon context system_u:object_r:bin_t:s0->system_u:object_r:consolekit_exec_t:s0 works now - thanks! (but I wouldn't say that this was not a bug, since an update fixed it.) |
Created attachment 788440 [details] relevant log lines from /var/log/messages starting at the point where the user performs the loing (lightdm) Description of problem: I'm running a freshly installed Fedora 19 with MATE. After providing the password at the login screen (lightdm), a SELinux log entry is created and a ConsoleKit timeout appears in /var/log/messages. I suspect that this is the reason for the ~51 seconds delay before the complete desktop appears - more details below. Version-Release number of selected component (if applicable): rpm -qa *selinux* libselinux-2.1.13-15.fc19.x86_64 libselinux-python-2.1.13-15.fc19.x86_64 selinux-policy-targeted-3.12.1-69.fc19.noarch selinux-policy-3.12.1-69.fc19.noarch libselinux-utils-2.1.13-15.fc19.x86_64 rpm -qa dbus* dbus-1.6.12-1.fc19.x86_64 dbus-glib-0.100-5.fc19.x86_64 dbus-python-1.1.1-5.fc19.x86_64 dbus-x11-1.6.12-1.fc19.x86_64 dbus-libs-1.6.12-1.fc19.x86_64 How reproducible: always (I can reproduce this in a seconds F19/MATE installation running in a VirtualBox) Steps to Reproduce: 1. Install Fedora 19 and choose MATE as your desktop environment 2. After the installation is complete enter the password at the login screen (lightdm) 3. observe/confirm the ~51 seconds delay before the destop environment appears (taskbars, Applications menu,..) Actual results: It takes ~51 seconds till the desktop environment appears after lightdm got the password from the user. Note the following log entry: console-kit-daemon[1565]: console-kit-daemon[1565]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.25" (uid=0 pid=1426 comm="lightdm --session-child 14 19 ") interface="org.freedesktop.ConsoleKit.Manager" member="OpenSessionWithParameters" error name="(unset)" requested_reply="0" destination="org.freedesktop.ConsoleKit" (uid=0 pid=1565 comm="/usr/sbin/console-kit-daemon --no-daemon ") and: dbus[768]: [system] Failed to activate service 'org.freedesktop.ConsoleKit': timed out Expected results: The desktop environment should appear within a few seconds. Additional info: comments for the attached logfile: @14:12:59: the user did hit enter at the lightdem login screen @14:13:51: the complete desktop environment appears